pomaly start win, predlzenie casu kopirovania, sekajuci zvuk

[eriduan]

prosim o kontrolu logu z RSITu
akonahle spustim pc, tak mam problem pustit coilen mp3 skladbu vo winampe. zvuk seka a samotna praca s diskom je nemozna. ked necham cokolvek kopirovat z disku na usb a naopak, tak priblizne 10 sekundova cinnost trva cele minuty. a to co sa kopirovalo predtym 5 min, sa teraz kopiruje 2 hodiny. takze mi nieco pracuje na pozadi, ale ja neviem co. neviem ako to detekovat, ale napadlo ma hjt, teda rsit.
dalej mi myska evidentne aj na maximalnom DPI nastaveni poskakuje (zrychluje aj spomaluje svoj pohyb nezavisle od uzivatelskych nastaveni) po obrazovke, pricom mam pod nou cisty biely papier

pravdepodobne viem ako sa to stalo, ale nechcem mrhat vasim casom, tak to sem napisem az na poziadanie.

PS.
je niekde na fore navod k UPS? milerad by som tu aplikaciu vedel pouzivat.

nizsie prikladam log z RSITu

Logfile of random's system information tool 1.06 (written by random/random)
Run by Kung-Pao at 2010-02-05 19:04:59
Systém Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 5 GB (12%) free of 36 GB
Total RAM: 1023 MB (58% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:05:49, on 5.2.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\ROCCAT\Kone Mouse\KoneHID.EXE
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Samsung\Samsung PC Studio 7\PCSuite.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\ROCCAT\Kone Mouse\osd.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclIrSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Documents and Settings\Kung-Pao\Desktop\vitrusy februar 2010\RSIT.exe
C:\Program Files\trend micro\Kung-Pao.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [P17Helper] Rundll32 SPIRun.dll,RunDLLEntry
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Kone] "C:\Program Files\ROCCAT\Kone Mouse\KoneHID.EXE"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [S60 PC Suite Tray] "C:\Program Files\Samsung\Samsung PC Studio 7\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Samsung.PCSync] "C:\Program Files\Samsung\Samsung PC Studio 7\PcSync2.exe" /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Kalendár.lnk = C:\WINDOWS\MENINY.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MIC273~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 0323249125
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://ccfiles.creative.com/Web/softwar ... /CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2C46E150-8BEC-4C4D-AA41-6AA18B179EBA}: NameServer = 10.100.1.200,0.0.0.0
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 7268 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-11 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-10-11 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"VolPanel"=C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe [2006-07-28 122880]
"P17Helper"=Rundll32 SPIRun.dll,RunDLLEntry []
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]
"Kone"=C:\Program Files\ROCCAT\Kone Mouse\KoneHID.EXE [2008-10-06 151552]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2009-05-14 2029640]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-10-03 35696]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-09-04 935288]
"Malwarebytes Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2009-09-10 1312080]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-10-11 149280]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-09-29 61440]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"NBJ"=C:\Program Files\Ahead\Nero BackItUp\NBJ.exe [2004-09-22 1871872]
"S60 PC Suite Tray"=C:\Program Files\Samsung\Samsung PC Studio 7\PCSuite.exe [2008-12-06 699392]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-10-03 35696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
C:\Program Files\Google\Google Talk\googletalk.exe [2007-01-01 3739648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCommunicationsManager]
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe [2006-12-22 497176]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe [2006-12-22 756248]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\S60 PC Suite Tray]
C:\Program Files\Samsung\Samsung PC Studio 7\PCSuite.exe [2008-12-06 699392]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSTray]
C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe [2007-12-14 132624]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Kung-Pao^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
C:\PROGRA~1\MICROS~2\Office12\ONENOTEM.EXE [2006-10-26 98632]

C:\Documents and Settings\Kung-Pao\Start Menu\Programs\Startup
Kalendár.lnk - C:\WINDOWS\MENINY.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [2008-12-22 356352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2009-09-30 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Disabled:Opera Internet Browser"
"C:\Program Files\Google\Google Talk\googletalk.exe"="C:\Program Files\Google\Google Talk\googletalk.exe:*:Enabled:Google Talk"
"C:\WINDOWS\system32\muzapp.exe"="C:\WINDOWS\system32\muzapp.exe:*:Enabled:MUZ AOD APP player"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{84440c3a-0b3d-11de-8c77-000461999395}]
shell\AutoRun\command - E:\LaunchU3.exe -a


======List of files/folders created in the last 1 months======

2010-02-05 19:04:59 ----D---- C:\rsit
2010-02-05 18:36:06 ----A---- C:\WINDOWS\ntbtlog.txt
2010-02-03 19:48:50 ----D---- C:\Documents and Settings\All Users\Application Data\ATI
2010-02-01 03:49:59 ----D---- C:\Documents and Settings\Kung-Pao\Application Data\InstallShield
2010-02-01 03:00:55 ----D---- C:\Documents and Settings\All Users\Application Data\InstallShield
2010-02-01 02:52:49 ----D---- C:\Program Files\Carbide.ui Theme Edition 3.4
2010-01-29 19:34:55 ----A---- C:\WINDOWS\mamba.ini
2010-01-27 00:58:02 ----A---- C:\WINDOWS\system32\javaws.exe
2010-01-27 00:58:01 ----A---- C:\WINDOWS\system32\javaw.exe
2010-01-27 00:58:01 ----A---- C:\WINDOWS\system32\java.exe
2010-01-13 19:39:14 ----D---- C:\Program Files\R-Studio
2010-01-08 14:47:37 ----D---- C:\Program Files\Mozilla Firefox

======List of files/folders modified in the last 1 months======

2010-02-05 19:05:04 ----D---- C:\Program Files\trend micro
2010-02-05 18:57:08 ----A---- C:\WINDOWS\win.ini
2010-02-05 18:57:05 ----D---- C:\WINDOWS\Temp
2010-02-05 18:55:54 ----D---- C:\WINDOWS\Prefetch
2010-02-05 18:37:57 ----D---- C:\Documents and Settings
2010-02-05 18:36:06 ----D---- C:\WINDOWS
2010-02-04 15:08:04 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-02-04 14:31:05 ----A---- C:\WINDOWS\wincmd.ini
2010-02-04 11:43:55 ----D---- C:\Documents and Settings\Kung-Pao\Application Data\vlc
2010-02-03 19:46:14 ----D---- C:\WINDOWS\system32
2010-02-03 19:44:47 ----D---- C:\WINDOWS\WinSxS
2010-02-03 19:44:40 ----SHD---- C:\WINDOWS\Installer
2010-02-03 19:44:36 ----D---- C:\Program Files\ATI Technologies
2010-02-03 19:41:30 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-02-03 19:41:24 ----D---- C:\WINDOWS\system32\drivers
2010-02-03 19:41:17 ----HD---- C:\WINDOWS\inf
2010-02-03 19:40:16 ----D---- C:\WINDOWS\system32\CatRoot2
2010-02-02 16:44:32 ----D---- C:\Program Files\XnView
2010-02-01 03:50:39 ----HD---- C:\Program Files\InstallShield Installation Information
2010-02-01 02:53:05 ----SD---- C:\WINDOWS\Downloaded Program Files
2010-02-01 02:53:04 ----D---- C:\Program Files\Common Files\InstallShield
2010-02-01 02:52:49 ----RD---- C:\Program Files
2010-01-31 15:57:45 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-01-31 14:24:11 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2010-01-27 00:57:48 ----D---- C:\Program Files\Java
2010-01-20 23:48:46 ----A---- C:\WINDOWS\ODBC.INI
2010-01-08 14:48:21 ----D---- C:\Documents and Settings\Kung-Pao\Application Data\Mozilla

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2009-05-14 107256]
R1 epfwtdi;epfwtdi; C:\WINDOWS\system32\DRIVERS\epfwtdi.sys [2009-05-14 55768]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14592]
R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS []
R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys []
R2 atksgt;atksgt; C:\WINDOWS\system32\DRIVERS\atksgt.sys [2010-01-29 278984]
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2009-05-14 114472]
R2 epfw;epfw; C:\WINDOWS\system32\DRIVERS\epfw.sys [2009-05-14 133000]
R2 irda;IrDA Protocol; C:\WINDOWS\system32\DRIVERS\irda.sys [2008-04-13 88192]
R2 lilsgt;lilsgt; C:\WINDOWS\system32\DRIVERS\lilsgt.sys [2009-06-11 12032]
R2 lirsgt;lirsgt; C:\WINDOWS\system32\DRIVERS\lirsgt.sys [2010-01-29 25416]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2009-09-30 3565056]
R3 ctsfm2k;Creative SoundFont Management Device Driver; C:\WINDOWS\system32\DRIVERS\ctsfm2k.sys [2005-12-08 142336]
R3 CTUSFSYN;Creative SoundFont Synthesizer; C:\WINDOWS\system32\drivers\ctusfsyn.sys [2006-08-07 162176]
R3 Epfwndis;Eset Personal Firewall; C:\WINDOWS\system32\DRIVERS\Epfwndis.sys [2009-05-14 33096]
R3 hidusb;HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 irsir;Microsoft Serial Infrared Driver; C:\WINDOWS\system32\DRIVERS\irsir.sys [2001-08-17 18688]
R3 KoneFltr;ROCCAT Kone; C:\WINDOWS\system32\drivers\Kone.sys [2008-09-22 12672]
R3 LVPr2Mon;Logitech LVPr2Mon Driver; C:\WINDOWS\system32\DRIVERS\LVPr2Mon.sys [2006-12-22 25632]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-08-04 12160]
R3 ossrv;Creative OS Services Driver; C:\WINDOWS\system32\DRIVERS\ctoss2k.sys [2005-12-08 114688]
R3 P17xfi;Sound Blaster X-Fi Xtreme Audio; C:\WINDOWS\system32\drivers\P17xfi.sys [2007-11-21 1174528]
R3 p17xfilt;p17xfilt; C:\WINDOWS\system32\drivers\p17xfilt.sys [2007-10-10 1664384]
R3 Rasirda;WAN Miniport (IrDA); C:\WINDOWS\system32\DRIVERS\rasirda.sys [2001-08-17 19584]
R3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbstor;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S2 ithsgt;ithsgt; C:\WINDOWS\system32\DRIVERS\ithsgt.sys []
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 cpuz130;cpuz130; \??\C:\DOCUME~1\Kung-Pao\LOCALS~1\Temp\cpuz130\cpuz_x32.sys []
S3 CrystalSysInfo;CrystalSysInfo; \??\C:\Program Files\MediaCoder\SysInfo.sys []
S3 ENTECH;ENTECH; \??\C:\WINDOWS\system32\DRIVERS\ENTECH.sys []
S3 LVcKap;Logitech AEC Driver; C:\WINDOWS\system32\DRIVERS\LVcKap.sys [2006-12-22 1683232]
S3 LVMVDrv;Logitech Machine Vision Engine Loader; C:\WINDOWS\system32\DRIVERS\LVMVDrv.sys [2006-12-22 1963680]
S3 LVUSBSta;Logitech USB Monitor Filter; C:\WINDOWS\system32\drivers\lvusbsta.sys [2006-12-14 41248]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 nmwcdsa;Samsung USB Phone Parent; C:\WINDOWS\system32\drivers\nmwcdsa.sys [2007-05-02 135680]
S3 nmwcdsac;Samsung USB Generic; C:\WINDOWS\system32\drivers\nmwcdsac.sys [2007-05-02 8320]
S3 nmwcdsacj;Samsung USB Port; C:\WINDOWS\system32\drivers\nmwcdsacj.sys [2007-05-02 12288]
S3 nmwcdsacm;Samsung USB Modem; C:\WINDOWS\system32\drivers\nmwcdsacm.sys [2007-05-02 12288]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 PID_0928;Logitech QuickCam Express(PID_0928); C:\WINDOWS\system32\DRIVERS\LV561AV.SYS [2006-12-14 490016]
S3 SASENUM;SASENUM; \??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS []
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 sscdbus;SAMSUNG USB Composite Device driver (WDM); C:\WINDOWS\system32\DRIVERS\sscdbus.sys [2007-07-03 80552]
S3 sscdmdfl;SAMSUNG Mobile Modem Filter; C:\WINDOWS\system32\DRIVERS\sscdmdfl.sys [2007-07-03 11944]
S3 sscdmdm;SAMSUNG Mobile Modem Drivers; C:\WINDOWS\system32\DRIVERS\sscdmdm.sys [2007-07-03 106792]
S3 SSUSBDownload;SAMSUNG SYMBIAN USB Downloader Driver; C:\WINDOWS\system32\DRIVERS\SSUSBDownload.sys [2008-07-30 17920]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-15 82688]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2009-09-30 602112]
R2 Creative Service for CDROM Access;Creative Service for CDROM Access; C:\WINDOWS\system32\CTsvcCDA.exe [1999-12-13 44032]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2009-05-14 731840]
R2 Irmon;Infrared Monitor; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-10-11 153376]
R2 LVPrcSrv;Process Monitor; c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe [2006-12-22 109344]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [2006-10-26 335872]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2008-11-11 620544]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2009-09-29 593920]
S2 LVSrvLauncher;LVSrvLauncher; C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe [2006-12-22 105248]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2009-05-14 20680]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

[Rudy]

Dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware

[eriduan]

mam problem, nedari sa mi restartovat pc do safe modu, odkedy som sa o to pokusil, tak mi vyskakuje blue screen of death. mam taky divny pocit ze to bude problem s grafickou kartou,

plus, dalsi problem bol ked som pustil malwarebytes antimalware, tak mi pri citani nejakych registrov alebo kniznice zrazu zamrzol pc, a restartoval sa, a ked som skusil spustit Rootkit Revealer tak tiez sa zasekol a restartoval.

dalsia vec je so spustanim pc,
normalne spustanie win xp trva 2-3 minuty, a ked nepripojim externy disk tak do minuty je hotovy
ale tentoraz sa spusta viac nez 10 min, a pritom cvaka rele ako pri stlaceni tlacitka "turn on pc" na bedni, a po nejakom desiatom cvaknuti sa pc uspesne restartuje same od seba aj pocas nabiehania win, a niekedy ak nabehne tak aj pocas bezania.

tento problem som v minulosti zazil, a dokonca aj niekde na forach riesil, ale vtedy bol na vine zdroj. pc malo vacsi odber, ale teraz je to asi rok odkedy som menil zdroj a do pc som pridal len jeden externy disk, a nic viac a ten ma vlastny kabel na energiu.povodny 300 W som nahradil 450 w pricom rezervu som nechal celych 120 w. (povodne mi chybalo na zdroji cca 20 - 30 w, preto mohol pc fungovat hoci podviziveny)

sorry za rozpisovanie, to len pre ilustraciu, ze pravdepodobne to moze byt aj problem so zdrojom, alebo mohol by v tom byt aj kolisajuci prud v zasuvke, ktory tu v panelaku pravdepodobne mame, to riesim prepatovou ochranou.

a raz som na forach riesil nieco s grafickou, ze vraj mala zle ovladace. ja som updatoval vcera na novy driver.

budem sa aj nadalej snazit spustit combofix v administratorovi, a ked sa mi to podari tak sem hodim log

[eriduan]

nooo, volaco naslo.

ComboFix 10-02-05.01 - Administrator . 02. 2010 22:06:17.3.1 - x86 MINIMAL
Systém Microsoft Windows XP Home Edition 5.1.2600.3.1250.421.1033.18.1023.822 [GMT 1:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
AV: ESET Smart Security 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\RECYCLER
c:\windows\jestertb.dll
c:\windows\system32\muzapp.exe
D:\RECYCLER

.
((((((((((((((((((((((((( Files Created from 2010-01-05 to 2010-02-05 )))))))))))))))))))))))))))))))
.

2010-02-05 19:26 . 2010-02-05 19:26 -------- d-----w- C:\rsit
2010-02-03 18:48 . 2010-02-03 18:48 -------- d-----w- c:\documents and settings\All Users\Application Data\ATI
2010-02-01 02:00 . 2010-02-01 02:00 -------- d-----w- c:\documents and settings\All Users\Application Data\InstallShield
2010-02-01 01:52 . 2010-02-01 02:56 -------- d-----w- c:\program files\Carbide.ui Theme Edition 3.4
2010-01-29 18:14 . 2010-01-29 18:14 278984 ----a-w- c:\windows\system32\drivers\atksgt.sys
2010-01-29 18:14 . 2010-01-29 18:14 25416 ----a-w- c:\windows\system32\drivers\lirsgt.sys
2010-01-13 18:39 . 2010-01-13 18:39 -------- d-----w- c:\program files\R-Studio
2010-01-08 13:48 . 2010-01-08 13:48 0 ----a-w- c:\windows\nsreg.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-05 19:22 . 2009-03-05 21:09 -------- d-----w- c:\program files\trend micro
2010-02-03 18:44 . 2008-12-26 13:55 -------- d-----w- c:\program files\ATI Technologies
2010-02-02 15:44 . 2008-12-27 21:57 -------- d-----w- c:\program files\XnView
2010-02-01 02:50 . 2008-12-26 13:55 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-01 01:53 . 2008-12-26 13:54 -------- d-----w- c:\program files\Common Files\InstallShield
2010-01-31 13:24 . 2009-01-13 23:34 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-01-26 23:57 . 2008-12-27 11:51 -------- d-----w- c:\program files\Java
2009-11-29 11:26 . 2009-11-29 11:26 4045527 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VolPanel"="c:\program files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" [2006-07-28 122880]
"P17Helper"="SPIRun.dll" [2006-07-03 10752]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"Kone"="c:\program files\ROCCAT\Kone Mouse\KoneHID.EXE" [2008-10-06 151552]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-05-14 2029640]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-09-29 61440]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"Samsung.PCSync"="c:\program files\Samsung\Samsung PC Studio 7\PcSync2.exe" [2009-06-04 1294336]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 10:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKLM\~\startupfolder\C:^Documents and Settings^Kung-Pao^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\documents and settings\Kung-Pao\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-10-03 03:08 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
2007-01-01 21:22 3739648 ----a-w- c:\program files\Google\Google Talk\googletalk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCommunicationsManager]
2006-12-22 11:27 497176 ----a-w- c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
2006-12-22 11:28 756248 ----a-w- c:\program files\Logitech\QuickCam10\QuickCam10.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 10:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\S60 PC Suite Tray]
2008-12-05 23:48 699392 ----a-w- c:\program files\Samsung\Samsung PC Studio 7\PCSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSTray]
2007-12-14 15:19 132624 ------w- c:\program files\Samsung\Samsung Media Studio 5\SMSTray.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys [27. 12. 2008 23:41 155136]
R0 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys [27. 12. 2008 23:41 5248]
R3 KoneFltr;ROCCAT Kone;c:\windows\system32\drivers\Kone.sys [3. 5. 2009 19:26 12672]
S1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [6. 2. 2009 14:23 107256]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [17. 2. 2009 11:43 8944]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [17. 2. 2009 11:43 55024]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [14. 5. 2009 14:47 731840]
S3 AXDOSYG;AXDOSYG;c:\docume~1\Kung-Pao\LOCALS~1\Temp\AXDOSYG.exe --> c:\docume~1\Kung-Pao\LOCALS~1\Temp\AXDOSYG.exe [?]
S3 cpuz130;cpuz130;\??\c:\docume~1\Kung-Pao\LOCALS~1\Temp\cpuz130\cpuz_x32.sys --> c:\docume~1\Kung-Pao\LOCALS~1\Temp\cpuz130\cpuz_x32.sys [?]
S3 nmwcdsa;Samsung USB Phone Parent;c:\windows\system32\drivers\nmwcdsa.sys [14. 8. 2009 22:55 135680]
S3 nmwcdsac;Samsung USB Generic;c:\windows\system32\drivers\nmwcdsac.sys [14. 8. 2009 22:55 8320]
S3 nmwcdsacj;Samsung USB Port;c:\windows\system32\drivers\nmwcdsacj.sys [14. 8. 2009 22:55 12288]
S3 nmwcdsacm;Samsung USB Modem;c:\windows\system32\drivers\nmwcdsacm.sys [14. 8. 2009 22:55 12288]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [17. 2. 2009 11:43 7408]
S3 SSUSBDownload;SAMSUNG SYMBIAN USB Downloader Driver;c:\windows\system32\drivers\SSUSBDownload.sys [14. 8. 2009 23:00 17920]
.
.
------- Supplementary Scan -------
.
TCP: {2C46E150-8BEC-4C4D-AA41-6AA18B179EBA} = 10.100.1.200,0.0.0.0
FF - ProfilePath -

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
.
- - - - ORPHANS REMOVED - - - -

AddRemove-box bob - g:\steam\SteamApps\SourceMods\box bob\uninst.exe
AddRemove-Get a Life_is1 - g:\steam\steamapps\SourceMods\Get_A_Life\unins000.exe
AddRemove-Half-Life - f:\sierra\Half-Life\Uninst.isu
AddRemove-Half-Life 2 Riot Act - g:\steam\SteamApps\SourceMods\half-life 2 riot act\uninst.exe
AddRemove-MINERVA: Metastasis - g:\steam\STEAMA~1\SOURCE~1\METAST~1\UNWISE.EXE
AddRemove-Portal Prelude SK - g:\steam\SteamApps\SourceMods\portal prelude\Uninstall PP_sK.exe
AddRemove-PORTAL SK - g:\steam\SteamApps\eriduan386\portal\Uninstall PORTAL_SK.exe
AddRemove-Shantytown - g:\steam\SteamApps\SourceMods\Shantytown\Uninstall.exe
AddRemove-Steam App 12910 - g:\steam\steam.exe
AddRemove-Steam App 17500 - g:\steam\steam.exe
AddRemove-Steam App 17550 - g:\steam\steam.exe
AddRemove-Steam App 17580 - g:\steam\steam.exe
AddRemove-Steam App 220 - g:\steam\steam.exe
AddRemove-Steam App 26810 - g:\steam\steam.exe
AddRemove-Steam App 340 - g:\steam\steam.exe
AddRemove-Steam App 380 - g:\steam\steam.exe
AddRemove-Steam App 400 - g:\steam\steam.exe
AddRemove-Steam App 420 - g:\steam\steam.exe
AddRemove-Steam App 440 - g:\steam\steam.exe
AddRemove-Steam App 590 - g:\steam\steam.exe
AddRemove-TweakOblivion_is1 - e:\bethesda softworks\Oblivion\TweakOblivion\unins000.exe
AddRemove-{4817189D-1785-4627-A33C-39FD90919300} - f:\sims2\Pets\EAUninstall.exe
AddRemove-{5C648FDB-0138-4619-B66E-230EF53E8E2C} - f:\sims2\Teen Style Stuff\EAUninstall.exe
AddRemove-{6522C636-B04C-4333-9BEB-9E0C0B6350D6} - f:\sims2\The Sims 2 Kitchen & Bath Interior Design Stuff\EAUninstall.exe
AddRemove-{6BDD9CE6-D0A6-478A-BAD3-BA6945E89EB0} - f:\sims2\Family Fun Stuff\EAUninstall.exe
AddRemove-{6E17F9751-F056-4335-B718-8AF1B1092AFB} - f:\sims2\The Sims 2 IKEA® Home Stuff\EAUninstall.exe
AddRemove-{7B3577F5-1D82-4C9B-008B-69D026FD8BCA} - f:\sims2\Open For Business\EAUninstall.exe
AddRemove-{84DDE556-43EF-43ed-B2DF-37AF9E5DDD75} - f:\sims2\H&M Fashion Stuff\EAUninstall.exe
AddRemove-{8FD3F4BA-A4A6-4380-00A6-CC6853AB2DC2} - f:\sims2\University\EAUninstall.exe
AddRemove-{9CDBC303-3EED-40b0-8E41-A7C65AA96C26} - f:\sims2\Glamour Life Stuff\EAUninstall.exe
AddRemove-{D25E18E7-2918-42D2-B09C-AC0F8F05AE6E}_is1 - o:\the tomorrow war\unins000.exe
AddRemove-{DFEF49D9-FC95-4301-99B9-2FB91C6ABA06} - f:\sims2\Seasons\EAUninstall.exe
AddRemove-{EAA38532-7AD0-4f78-918A-4F4F02096ECE} - f:\sims2\Celebration Stuff\EAUninstall.exe
AddRemove-{F248ADFA-64E0-4b03-8A83-059078BED6A0} - f:\sims2\Bon Voyage\EAUninstall.exe
AddRemove-{F7529650-B9DB-481B-0089-A2AC3C2821C1} - f:\sims2\Nightlife\EAUninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-05 22:11
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
P17Helper = Rundll32 SPIRun.dll,RunDLLEntry?

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x866A0060]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf7872f28
\Driver\ACPI -> ACPI.sys @ 0xf77bfcb8
\Driver\atapi -> 0x866a0060
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a05a8
ParseProcedure -> ntoskrnl.exe @ 0x8056c1d6
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a05a8
ParseProcedure -> ntoskrnl.exe @ 0x8056c1d6
Warning: possible MBR rootkit infection !
user & kernel MBR OK
copy of MBR has been found in sector 11 !
copy of MBR has been found in sector 50 !

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OOPM02.00.00.01PRO"="72C89A0D0178419FC4234098BC58F95018A7AB096618DC2A3FCDA872EA0C24DE94C85E29817A4A2B54718BFEED47F0A54C449A991CC01B0ED2698447FBE6B8391A4E7AF4BED87802C6D3EB28D0BFF554DF855611BA52AEC20AE363A33AE94E2B16C1DA4FBE2640EDD92B63B1A89722B7DE65936FE20E74D25EF0CF8A41DF249090ACFE5A3A52E6BEC2FB06FEEA8DDFB04A009BF7E51A1A503EE569C061F5504C03BF797C20B784C6296CF9B7C1416C201717CA354EFEA34F0ABD604E1F3FB9C2DCCCF1DE129088DBA84A7DC58DB65B702F8F93F1562A6AE899147C0134B120DE82C9A4F063FB3458D2036059DEFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933C038D530D6EB34525D575E7D6A3B9808A6171C11EC38DE3D8101EE5CA9100C02C52387B5549388BD2265150C87481E735436508B3194946E8A44119A600878BD868F00B52E26D871CE56639D3A6F1BB0F6CAEBD1B4C1539FE99E23DE760FB693D258E27C30D517158CFE52F220F97438A40E09E2DEDD1A3FEDC4A9C4BA56CC0EA2B72150A1EA88709A3CE7241867D22F8524DDC04AB99170C6BFA859212605F0513BB16E6E413A069DC3AA37A84821F12906A1E1B4BD288C8D6C29A1BE586D309E4410062748F9849E1AA5AA7A41111080FB123180E18E9FBBFB3A944FDED8F5AC88BA3CFE855BD4099B69EEDA8D95CD60A9EE0CB23639EAAF726D9C333B5DA08413B3A74E11B690ADF589E8B978E7A10281FD44F5DB62622BA8D718EA0554408FC082569017250642AB1D722DE382B603C98720970A06AF554B935A1F67DC1B9F4431C567D706B8DD933F58EB45A76D652057590B0A66AD38DB3DAB1922D72B6522CE6B14A6FEDEFBD990DAD5255B598D733F9DE33B096DC3AE77C4C9876C1DFA346EAF7F6DF3E1FE7BB530E8A2E3C1C6881310DD0F35B3C7EC67D7C2800552D9A8256DB6A713E0AACC5480CCEC4FA23CF42CC5D50C78797B12B7053A86CEE062810FF5E7E548AFA67319E8C8CAEB2A7FA7E5494ECC26EAFA7195E40D2ABB13D7944A0CE84CC95300EA337AC994CF3D885D22986CFD5067C22DB181390E83E5E08A786830920D872701D6BA61B851732D2C46A5FAE45306363F42DB61E81F890A63C2B6D886CCB9EF5A3B2244B60E96AD7AB856E7D4490D9A7402E4CC08CC65C16ED11825868A0D93EB9C9E4AA56628AA83670444B995791CECAC04E5C88F91DBD2D420770886D6AD013A10F1AD7CDBA7D9C37EC5125C7CC69E0694BB1F2C5C8F8A7E5558134AA3BE39D7CB5B0CB996115E4086C76E867A105152E58192AD4779E285B5F2439EB0AB853D1BCA12CB76B2C958D24777428BCB225ABA8E3DE20896FCA4AF184A9571BD2F353BABA69FC9BDA8860D66E4007CB502ED"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(220)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2010-02-05 22:13:12
ComboFix-quarantined-files.txt 2010-02-05 21:13

Pre-Run: 4 674 949 120 bytes free
Post-Run: 4 642 820 096 bytes free

- - End Of File - - 4BE4478345F4ED0843120F9FF8F14CCB

[Rudy]

Ještě dočistíme. Otevřte poznámkový blok a zkopírujte do něj:

Collect::
c:\docume~1\Kung-Pao\LOCALS~1\Temp\AXDOSYG.exe

Driver::
AXDOSYG

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

[eriduan]

dobre dal som to collect

ale mam otazku.

combofix ked sa spustil tak zahlasil okno ktore som potvrdil bo som chcel pokracovat ale potom sa ma pytal nieco taketo

::
this machine does not have the 'microsoft windows recovery console'
without it, combofix shall not attempt the fixing of some serious infections
click yes to have combofix download/install it.
note: this requires an active internet connection.

ale ja som spustil combofix v safe mode administratorovi bez networkingu.
takze mi ani prvy krat nemohol najst net ale combofix potom pokracoval.

co mam robit. co to znamena ten 'microsoft windows recovery console'?
to je akoze to co mam vypnute? pretoze ja mam vypnuty system recovery vec.
je to problem?

mam pustit combofix v normalnom mode nie safemode?

[eriduan]

ok asi to collectlo vsetko spravne

ale pc sa restartoval ale uz nie do safe modu ale rovno do normalu. a stale mi ide ten zvuk tak sekane, stale mam problem so spomalnym windowsom.



ComboFix 10-02-05.01 - Administrator . 02. 2010 23:12:55.4.1 - x86 MINIMAL
Systém Microsoft Windows XP Home Edition 5.1.2600.3.1250.421.1033.18.1023.822 [GMT 1:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt.txt
AV: ESET Smart Security 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

file zipped: c:\docume~1\Kung-Pao\LOCALS~1\Temp\AXDOSYG.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_AXDOSYG
-------\Service_AXDOSYG


((((((((((((((((((((((((( Files Created from 2010-01-05 to 2010-02-05 )))))))))))))))))))))))))))))))
.

2010-02-05 19:26 . 2010-02-05 19:26 -------- d-----w- C:\rsit
2010-02-03 18:48 . 2010-02-03 18:48 -------- d-----w- c:\documents and settings\All Users\Application Data\ATI
2010-02-01 02:49 . 2010-02-01 02:49 -------- d-----w- c:\documents and settings\Kung-Pao\Application Data\InstallShield
2010-02-01 02:00 . 2010-02-01 02:00 -------- d-----w- c:\documents and settings\All Users\Application Data\InstallShield
2010-02-01 01:52 . 2010-02-01 02:56 -------- d-----w- c:\program files\Carbide.ui Theme Edition 3.4
2010-01-29 18:14 . 2010-01-29 18:14 278984 ----a-w- c:\windows\system32\drivers\atksgt.sys
2010-01-29 18:14 . 2010-01-29 18:14 25416 ----a-w- c:\windows\system32\drivers\lirsgt.sys
2010-01-26 23:55 . 2010-01-26 23:55 152576 ----a-w- c:\documents and settings\Kung-Pao\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2010-01-26 23:54 . 2010-01-26 23:54 79488 ----a-w- c:\documents and settings\Kung-Pao\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-01-13 18:39 . 2010-01-13 18:39 -------- d-----w- c:\program files\R-Studio
2010-01-08 13:48 . 2010-01-08 13:48 0 ----a-w- c:\windows\nsreg.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-05 19:22 . 2009-03-05 21:09 -------- d-----w- c:\program files\trend micro
2010-02-04 10:43 . 2009-08-18 16:36 -------- d-----w- c:\documents and settings\Kung-Pao\Application Data\vlc
2010-02-03 18:44 . 2008-12-26 13:55 -------- d-----w- c:\program files\ATI Technologies
2010-02-02 15:56 . 2009-08-14 22:00 -------- d-----w- c:\documents and settings\Kung-Pao\Application Data\Samsung
2010-02-02 15:44 . 2008-12-27 21:57 -------- d-----w- c:\program files\XnView
2010-02-01 02:50 . 2008-12-26 13:55 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-01 01:53 . 2008-12-26 13:54 -------- d-----w- c:\program files\Common Files\InstallShield
2010-01-31 13:24 . 2009-01-13 23:34 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-01-29 08:27 . 2009-03-07 17:44 -------- d-----w- c:\documents and settings\Kung-Pao\Application Data\dvdcss
2010-01-26 23:57 . 2008-12-27 11:51 -------- d-----w- c:\program files\Java
2009-12-24 22:15 . 2009-02-19 17:12 -------- d-----w- c:\documents and settings\Kung-Pao\Application Data\Skype
2009-11-29 11:26 . 2009-11-29 11:26 4045527 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NBJ"="c:\program files\Ahead\Nero BackItUp\NBJ.exe" [2004-09-22 1871872]
"S60 PC Suite Tray"="c:\program files\Samsung\Samsung PC Studio 7\PCSuite.exe" [2008-12-05 699392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VolPanel"="c:\program files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" [2006-07-28 122880]
"P17Helper"="SPIRun.dll" [2006-07-03 10752]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"Kone"="c:\program files\ROCCAT\Kone Mouse\KoneHID.EXE" [2008-10-06 151552]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-05-14 2029640]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-09-29 61440]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"Samsung.PCSync"="c:\program files\Samsung\Samsung PC Studio 7\PcSync2.exe" [2009-06-04 1294336]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 10:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKLM\~\startupfolder\C:^Documents and Settings^Kung-Pao^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\documents and settings\Kung-Pao\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-10-03 03:08 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
2007-01-01 21:22 3739648 ----a-w- c:\program files\Google\Google Talk\googletalk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCommunicationsManager]
2006-12-22 11:27 497176 ----a-w- c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
2006-12-22 11:28 756248 ----a-w- c:\program files\Logitech\QuickCam10\QuickCam10.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 10:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\S60 PC Suite Tray]
2008-12-05 23:48 699392 ----a-w- c:\program files\Samsung\Samsung PC Studio 7\PCSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSTray]
2007-12-14 15:19 132624 ------w- c:\program files\Samsung\Samsung Media Studio 5\SMSTray.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys [27.12.2008 23:41 155136]
R0 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys [27.12.2008 23:41 5248]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [6.2.2009 14:23 107256]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [17.2.2009 11:43 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [17.2.2009 11:43 55024]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [14.5.2009 14:47 731840]
R3 KoneFltr;ROCCAT Kone;c:\windows\system32\drivers\Kone.sys [3.5.2009 19:26 12672]
S3 cpuz130;cpuz130;\??\c:\docume~1\Kung-Pao\LOCALS~1\Temp\cpuz130\cpuz_x32.sys --> c:\docume~1\Kung-Pao\LOCALS~1\Temp\cpuz130\cpuz_x32.sys [?]
S3 nmwcdsa;Samsung USB Phone Parent;c:\windows\system32\drivers\nmwcdsa.sys [14.8.2009 22:55 135680]
S3 nmwcdsac;Samsung USB Generic;c:\windows\system32\drivers\nmwcdsac.sys [14.8.2009 22:55 8320]
S3 nmwcdsacj;Samsung USB Port;c:\windows\system32\drivers\nmwcdsacj.sys [14.8.2009 22:55 12288]
S3 nmwcdsacm;Samsung USB Modem;c:\windows\system32\drivers\nmwcdsacm.sys [14.8.2009 22:55 12288]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [17.2.2009 11:43 7408]
S3 SSUSBDownload;SAMSUNG SYMBIAN USB Downloader Driver;c:\windows\system32\drivers\SSUSBDownload.sys [14.8.2009 23:00 17920]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{84440c3a-0b3d-11de-8c77-000461999395}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: {2C46E150-8BEC-4C4D-AA41-6AA18B179EBA} = 10.100.1.200,0.0.0.0
FF - ProfilePath - c:\documents and settings\Kung-Pao\Application Data\Mozilla\Firefox\Profiles\areqlj0n.default\
FF - prefs.js: browser.startup.homepage - hxxps://mail.google.com/mail

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-05 23:27
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
P17Helper = Rundll32 SPIRun.dll,RunDLLEntry?

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x86639F00]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf761ff28
\Driver\ACPI -> ACPI.sys @ 0xf748ccb8
\Driver\atapi -> 0x86639f00
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579022
ParseProcedure -> ntkrnlpa.exe @ 0x80577c84
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579022
ParseProcedure -> ntkrnlpa.exe @ 0x80577c84
NDIS: Realtek RTL8139 Family PCI Fast Ethernet NIC -> SendCompleteHandler -> NDIS.sys @ 0xf7326bd4
PacketIndicateHandler -> NDIS.sys @ 0xf7314a0d
SendHandler -> NDIS.sys @ 0xf7328b40
Warning: possible MBR rootkit infection !
user & kernel MBR OK
copy of MBR has been found in sector 11 !
copy of MBR has been found in sector 50 !

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-861567501-926492609-725345543-1004\Software\SecuROM\License information*]
"datasecu"=hex:86,85,d2,4c,b9,1b,e0,dc,6b,3b,82,14,6f,24,c4,0d,b3,eb,12,a3,81,
ab,b7,c2,f7,af,e7,94,2e,25,dc,20,25,fd,77,a5,e4,a6,ee,c8,49,2f,98,43,d2,3f,\
"rkeysecu"=hex:45,41,77,05,b9,b4,ee,6c,61,69,0a,aa,32,8e,10,7e

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OOPM02.00.00.01PRO"="72C89A0D0178419FC4234098BC58F95018A7AB096618DC2A3FCDA872EA0C24DE94C85E29817A4A2B54718BFEED47F0A54C449A991CC01B0ED2698447FBE6B8391A4E7AF4BED87802C6D3EB28D0BFF554DF855611BA52AEC20AE363A33AE94E2B16C1DA4FBE2640EDD92B63B1A89722B7DE65936FE20E74D25EF0CF8A41DF249090ACFE5A3A52E6BEC2FB06FEEA8DDFB04A009BF7E51A1A503EE569C061F5504C03BF797C20B784C6296CF9B7C1416C201717CA354EFEA34F0ABD604E1F3FB9C2DCCCF1DE129088DBA84A7DC58DB65B702F8F93F1562A6AE899147C0134B120DE82C9A4F063FB3458D2036059DEFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933C038D530D6EB34525D575E7D6A3B9808A6171C11EC38DE3D8101EE5CA9100C02C52387B5549388BD2265150C87481E735436508B3194946E8A44119A600878BD868F00B52E26D871CE56639D3A6F1BB0F6CAEBD1B4C1539FE99E23DE760FB693D258E27C30D517158CFE52F220F97438A40E09E2DEDD1A3FEDC4A9C4BA56CC0EA2B72150A1EA88709A3CE7241867D22F8524DDC04AB99170C6BFA859212605F0513BB16E6E413A069DC3AA37A84821F12906A1E1B4BD288C8D6C29A1BE586D309E4410062748F9849E1AA5AA7A41111080FB123180E18E9FBBFB3A944FDED8F5AC88BA3CFE855BD4099B69EEDA8D95CD60A9EE0CB23639EAAF726D9C333B5DA08413B3A74E11B690ADF589E8B978E7A10281FD44F5DB62622BA8D718EA0554408FC082569017250642AB1D722DE382B603C98720970A06AF554B935A1F67DC1B9F4431C567D706B8DD933F58EB45A76D652057590B0A66AD38DB3DAB1922D72B6522CE6B14A6FEDEFBD990DAD5255B598D733F9DE33B096DC3AE77C4C9876C1DFA346EAF7F6DF3E1FE7BB530E8A2E3C1C6881310DD0F35B3C7EC67D7C2800552D9A8256DB6A713E0AACC5480CCEC4FA23CF42CC5D50C78797B12B7053A86CEE062810FF5E7E548AFA67319E8C8CAEB2A7FA7E5494ECC26EAFA7195E40D2ABB13D7944A0CE84CC95300EA337AC994CF3D885D22986CFD5067C22DB181390E83E5E08A786830920D872701D6BA61B851732D2C46A5FAE45306363F42DB61E81F890A63C2B6D886CCB9EF5A3B2244B60E96AD7AB856E7D4490D9A7402E4CC08CC65C16ED11825868A0D93EB9C9E4AA56628AA83670444B995791CECAC04E5C88F91DBD2D420770886D6AD013A10F1AD7CDBA7D9C37EC5125C7CC69E0694BB1F2C5C8F8A7E5558134AA3BE39D7CB5B0CB996115E4086C76E867A105152E58192AD4779E285B5F2439EB0AB853D1BCA12CB76B2C958D24777428BCB225ABA8E3DE20896FCA4AF184A9571BD2F353BABA69FC9BDA8860D66E4007CB502ED"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(872)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(4312)
c:\program files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Samsung\Samsung PC Studio 7\phonebrowser.dll
c:\program files\Samsung\Samsung PC Studio 7\PCSCM_Samsung.dll
c:\program files\Samsung\Samsung PC Studio 7\Lang\PhoneBrowser_eng.nlr
c:\program files\Samsung\Samsung PC Studio 7\Resource\PhoneBrowser_Samsung.ngr
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe
c:\windows\system32\CTsvcCDA.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\Rundll32.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ROCCAT\Kone Mouse\osd.exe
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclIrSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
.
**************************************************************************
.
Completion time: 2010-02-05 23:36:01 - machine was rebooted
ComboFix-quarantined-files.txt 2010-02-05 22:35
ComboFix2.txt 2010-02-05 21:13

Pre-Run: 4 652 093 440 bytes free
Post-Run: 4 554 702 848 bytes free

- - End Of File - - 607ECD3EED93D4EB1EF4C3D2765AE591

[eriduan]

zda sa mi ze to nefungovalo, pc sa stale sprava tak divne spomalene a seka vsetko co moze sekat. posledne spustenie trvalo 15 minut. takze sa nic nezmenilo. je v tom nieco ine ako to co sme liecili.
myslim ze tu pomoze len format C

sakris, ale ako zazalohujem vsetky tie data, ked ani kopirovanie poriadne nefunguje a ja mam na cecku k sakru vela veci?

[Rudy]

No, zálohy bych doporučil udělat, podle logu je pravděpodobně nějaký problém s MBR. Udělejte toto:

1. Spusťte CF ještě jednou tímto skriptem:

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{84440c3a-0b3d-11de-8c77-000461999395}]

2. proveďte sken MBR: http://www2.gmer.net/mbr/mbr.exe a dejte log.

[eriduan]

mozem sa nieco opytat?

1.ten gmer mbr.exe subor mam dat iba na plochu a potom spustit?
2.ked sa ma combofix pyta na nenainstalovany microsoft windows recovery console, tak je v poriadku ked davam ze nie, neinstalovat?
3.CF mi prave bezi s tym lanunch u3 registrom, potom ked to dobehne mam sem dat aj log z CF?

EDIT>
dokoncili mi tie skeny tak sem prikladam informacie, ale ak budete taky laskavy a odpoviete mi na otazky tak mi to vadit nebude.
a k tomu mam este tuto otazku
4. vzdy ked spustim rootkit revealer tak najde asi 10 veci na opravu, ale ani za nic neviem ulozit log, vzdy ked sa o to
pokusam tak mi spadne ten program a log ulozi prazdny s velkostou 0Kb. je tu este nejaka ina moznost ako tie veci v rootkit
revealer scanu vyliecit bez toho aby som ukladal log?

EDIT 2> prilozil som do tohoto prispevku aspon prtscr z RR kedze log neviem savenut, najdlhsie som ho nechal 10 minut
ukladat a potom ma to prestalo bavit cakat tak som to zrusil.



EDIT 3

skusil som spustit GMER, avsak nevedelo ho spustit, tak som ho premenoval na test.exe, tak ako to pisu na gmer.net
stranke, ale akonahle sa gmer spusti tak dolu na liste prebehne nejake qick skenovanie a ja este ani nstihnem stlacit scan a
uz mi win vyhodi kriticku chybu a program zavrie. on ho normalne zhodi. skusim est eice sword. ale neviem ci to pojde.


toto co je nizsie patri este pod edit 1
log z mbr mi urobilo nejak rychlo. a co v nom bolo je toto

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK
copy of MBR has been found in sector 11 !
copy of MBR has been found in sector 50 !



a tu prikladam CF log



ComboFix 10-02-05.01 - Kung-Pao 07.02.2010 22:39:35.6.1 - x86
Systém Microsoft Windows XP Home Edition 5.1.2600.3.1250.421.1033.18.1023.600 [GMT 1:00]
Running from: c:\documents and settings\Kung-Pao\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Kung-Pao\Desktop\CFScript.txt
AV: ESET Smart Security 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2010-01-07 to 2010-02-07 )))))))))))))))))))))))))))))))
.

2010-02-05 19:26 . 2010-02-05 19:26 -------- d-----w- C:\rsit
2010-02-03 18:48 . 2010-02-03 18:48 -------- d-----w- c:\documents and settings\All Users\Application Data\ATI
2010-02-01 02:49 . 2010-02-01 02:49 -------- d-----w- c:\documents and settings\Kung-Pao\Application Data\InstallShield
2010-02-01 02:00 . 2010-02-01 02:00 -------- d-----w- c:\documents and settings\All Users\Application Data\InstallShield
2010-02-01 01:52 . 2010-02-01 02:56 -------- d-----w- c:\program files\Carbide.ui Theme Edition 3.4
2010-01-29 18:14 . 2010-01-29 18:14 278984 ----a-w- c:\windows\system32\drivers\atksgt.sys
2010-01-29 18:14 . 2010-01-29 18:14 25416 ----a-w- c:\windows\system32\drivers\lirsgt.sys
2010-01-26 23:55 . 2010-01-26 23:55 152576 ----a-w- c:\documents and settings\Kung-Pao\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2010-01-26 23:54 . 2010-01-26 23:54 79488 ----a-w- c:\documents and settings\Kung-Pao\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-01-13 18:39 . 2010-01-13 18:39 -------- d-----w- c:\program files\R-Studio

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-05 23:36 . 2008-12-26 13:55 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-05 23:35 . 2008-12-26 15:14 413696 ----a-w- c:\windows\system32\wrap_oal.dll
2010-02-05 23:35 . 2008-12-26 15:14 102400 ----a-w- c:\windows\system32\OpenAL32.dll
2010-02-05 19:22 . 2009-03-05 21:09 -------- d-----w- c:\program files\trend micro
2010-02-04 10:43 . 2009-08-18 16:36 -------- d-----w- c:\documents and settings\Kung-Pao\Application Data\vlc
2010-02-03 18:44 . 2008-12-26 13:55 -------- d-----w- c:\program files\ATI Technologies
2010-02-02 15:56 . 2009-08-14 22:00 -------- d-----w- c:\documents and settings\Kung-Pao\Application Data\Samsung
2010-02-02 15:44 . 2008-12-27 21:57 -------- d-----w- c:\program files\XnView
2010-02-01 01:53 . 2008-12-26 13:54 -------- d-----w- c:\program files\Common Files\InstallShield
2010-01-31 13:24 . 2009-01-13 23:34 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-01-29 08:27 . 2009-03-07 17:44 -------- d-----w- c:\documents and settings\Kung-Pao\Application Data\dvdcss
2010-01-26 23:57 . 2008-12-27 11:51 -------- d-----w- c:\program files\Java
2010-01-08 13:48 . 2010-01-08 13:48 0 ----a-w- c:\windows\nsreg.dat
2009-12-24 22:15 . 2009-02-19 17:12 -------- d-----w- c:\documents and settings\Kung-Pao\Application Data\Skype
2009-11-29 11:26 . 2009-11-29 11:26 4045527 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
.

((((((((((((((((((((((((((((( SnapShot@2010-02-05_21.11.05 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-02-07 21:29 . 2010-02-07 21:29 16384 c:\windows\temp\Perflib_Perfdata_7ac.dat
+ 2010-02-05 23:35 . 2006-07-03 11:43 10752 c:\windows\system32\ReinstallBackups\0012\DriverFiles\SPIRun.dll
+ 2010-02-05 23:35 . 2003-10-02 17:48 53248 c:\windows\system32\ReinstallBackups\0012\DriverFiles\P17CPI.dll
+ 2010-02-05 23:35 . 2008-04-14 00:12 23552 c:\windows\system32\ReinstallBackups\0012\DriverFiles\i386\wdmaud.drv
+ 2010-02-05 23:35 . 2008-04-13 18:45 49408 c:\windows\system32\ReinstallBackups\0012\DriverFiles\i386\stream.sys
+ 2010-02-05 23:35 . 2008-04-13 18:45 60160 c:\windows\system32\ReinstallBackups\0012\DriverFiles\i386\drmk.sys
+ 2010-02-05 23:35 . 2002-04-11 00:41 65536 c:\windows\system32\ReinstallBackups\0012\DriverFiles\A3d.dll
+ 2010-02-05 23:36 . 2005-12-08 10:54 21504 c:\windows\system32\ReinstallBackups\0011\DriverFiles\W2KXPDRV\sfman32.dll
+ 2010-02-05 23:20 . 2009-09-30 01:27 45056 c:\windows\system32\ReinstallBackups\0001\DriverFiles\aticalrt.dll
+ 2010-02-05 23:20 . 2009-09-30 01:27 45056 c:\windows\system32\ReinstallBackups\0001\DriverFiles\aticalcl.dll
+ 2010-02-05 23:19 . 2009-09-30 01:27 45056 c:\windows\system32\ReinstallBackups\0000\DriverFiles\aticalrt.dll
+ 2010-02-05 23:19 . 2009-09-30 01:27 45056 c:\windows\system32\ReinstallBackups\0000\DriverFiles\aticalcl.dll
+ 2006-01-05 03:10 . 2008-12-01 19:51 53248 c:\windows\system32\drivers\ati2erec.dll
- 2006-01-05 03:10 . 2009-09-30 01:27 53248 c:\windows\system32\drivers\ati2erec.dll
- 2006-01-05 03:10 . 2009-09-30 01:28 17408 c:\windows\system32\atitvo32.dll
+ 2006-01-05 03:10 . 2008-12-01 19:52 17408 c:\windows\system32\atitvo32.dll
+ 2006-01-05 03:39 . 2008-12-01 20:37 53248 c:\windows\system32\ATIDDC.DLL
- 2006-01-05 03:39 . 2009-09-30 02:07 53248 c:\windows\system32\ATIDDC.DLL
+ 2008-12-01 19:52 . 2008-12-01 19:52 86016 c:\windows\system32\atiadlxx.dll
- 2006-01-05 03:41 . 2009-09-30 02:10 26112 c:\windows\system32\Ati2mdxx.exe
+ 2006-01-05 03:41 . 2008-12-01 20:40 26112 c:\windows\system32\Ati2mdxx.exe
- 2006-01-05 03:41 . 2009-09-30 02:10 43520 c:\windows\system32\ati2edxx.dll
+ 2006-01-05 03:41 . 2008-12-01 20:40 43520 c:\windows\system32\ati2edxx.dll
+ 2008-12-01 19:57 . 2008-12-01 19:57 48640 c:\windows\system32\amdpcom32.dll
+ 2008-12-01 19:53 . 2008-12-01 19:53 45056 c:\windows\system32\amdcalrt.dll
+ 2008-12-01 19:53 . 2008-12-01 19:53 45056 c:\windows\system32\amdcalcl.dll
+ 2010-02-05 23:35 . 2004-12-22 18:58 8704 c:\windows\system32\ReinstallBackups\0012\DriverFiles\i386\Pfmodnt.sys
+ 2010-02-05 23:35 . 2008-04-14 00:11 4096 c:\windows\system32\ReinstallBackups\0012\DriverFiles\i386\ksuser.dll
+ 2010-02-05 23:35 . 2006-01-25 13:55 137728 c:\windows\system32\ReinstallBackups\0012\DriverFiles\P17res.dll
+ 2010-02-05 23:35 . 2007-05-08 07:59 137216 c:\windows\system32\ReinstallBackups\0012\DriverFiles\OemSpi.dll
+ 2010-02-05 23:35 . 2008-04-13 19:19 146048 c:\windows\system32\ReinstallBackups\0012\DriverFiles\i386\portcls.sys
+ 2010-02-05 23:35 . 2008-04-13 19:16 141056 c:\windows\system32\ReinstallBackups\0012\DriverFiles\i386\ks.sys
+ 2010-02-05 23:35 . 2007-10-16 17:59 171520 c:\windows\system32\ReinstallBackups\0012\DriverFiles\i386\CtDvIns1.dll
+ 2010-02-05 23:36 . 2005-12-08 10:54 120832 c:\windows\system32\ReinstallBackups\0011\DriverFiles\W2KXPDRV\sfms32.dll
+ 2010-02-05 23:36 . 2006-08-07 18:30 162176 c:\windows\system32\ReinstallBackups\0011\DriverFiles\W2KXPDRV\ctusfsyn.sys
+ 2010-02-05 23:36 . 2005-12-08 10:54 142336 c:\windows\system32\ReinstallBackups\0011\DriverFiles\W2KXPDRV\ctsfm2k.sys
+ 2010-02-05 23:36 . 2005-12-08 10:54 114688 c:\windows\system32\ReinstallBackups\0011\DriverFiles\W2KXPDRV\ctoss2k.sys
+ 2006-01-05 03:41 . 2008-12-01 20:40 147456 c:\windows\system32\Oemdspif.dll
+ 2006-01-05 03:41 . 2008-12-01 20:41 188416 c:\windows\system32\atipdlxx.dll
+ 2008-12-01 19:50 . 2008-12-01 19:50 286720 c:\windows\system32\atiok3x2.dll
+ 2006-01-05 03:11 . 2008-12-01 19:53 401408 c:\windows\system32\atikvmag.dll
+ 2008-12-26 13:55 . 2008-12-01 20:19 307200 c:\windows\system32\atiiiexx.dll
- 2008-12-26 13:55 . 2009-09-30 02:08 307200 c:\windows\system32\atiiiexx.dll
+ 2008-12-26 13:55 . 2008-10-30 14:45 180720 c:\windows\system32\atiicdxx.dat
+ 2008-12-01 20:52 . 2008-12-01 20:52 425984 c:\windows\system32\ATIDEMGX.dll
+ 2008-12-26 13:55 . 2008-12-01 13:35 593920 c:\windows\system32\ati2sgag.exe
- 2008-12-26 13:55 . 2009-09-29 20:15 593920 c:\windows\system32\ati2sgag.exe
+ 2006-01-05 03:39 . 2008-12-01 20:38 598016 c:\windows\system32\ati2evxx.exe
+ 2006-01-05 03:41 . 2008-12-01 20:40 143360 c:\windows\system32\ati2evxx.dll
+ 2006-01-05 03:47 . 2008-12-01 20:51 318464 c:\windows\system32\ati2dvag.dll
+ 2006-01-05 03:05 . 2008-12-01 19:45 577536 c:\windows\system32\ati2cqag.dll
+ 2010-02-05 23:35 . 2007-10-10 18:31 1664384 c:\windows\system32\ReinstallBackups\0012\DriverFiles\i386\p17xfilt.sys
+ 2010-02-05 23:35 . 2007-11-21 16:06 1174528 c:\windows\system32\ReinstallBackups\0012\DriverFiles\i386\P17xfi.sys
+ 2010-02-05 23:20 . 2009-09-30 01:26 3227648 c:\windows\system32\ReinstallBackups\0001\DriverFiles\aticaldd.dll
+ 2010-02-05 23:19 . 2009-09-30 01:26 3227648 c:\windows\system32\ReinstallBackups\0000\DriverFiles\aticaldd.dll
+ 2006-01-05 03:46 . 2008-12-01 22:13 3452928 c:\windows\system32\drivers\ati2mtag.sys
+ 2006-01-05 03:46 . 2008-12-01 22:13 3452928 c:\windows\system32\dllcache\ati2mtag.sys
+ 2006-01-05 03:25 . 2008-12-01 20:11 2495360 c:\windows\system32\ativvaxx.dll
+ 2006-01-05 03:31 . 2008-12-01 20:27 4120384 c:\windows\system32\ati3duag.dll
+ 2008-12-01 19:50 . 2008-12-01 19:50 3252224 c:\windows\system32\Amdcaldd.dll
+ 2006-01-05 03:01 . 2008-12-01 20:46 11304960 c:\windows\system32\atioglxx.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NBJ"="c:\program files\Ahead\Nero BackItUp\NBJ.exe" [2004-09-22 1871872]
"CreativeTaskScheduler"="c:\program files\Creative\Shared Files\CTSched.exe" [2006-11-17 53341]
"S60 PC Suite Tray"="c:\program files\Samsung\Samsung PC Studio 7\PCSuite.exe" [2008-12-05 699392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VolPanel"="c:\program files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" [2006-07-28 122880]
"P17Helper"="SPIRun.dll" [2006-07-03 10752]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"Kone"="c:\program files\ROCCAT\Kone Mouse\KoneHID.EXE" [2008-10-06 151552]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-05-14 2029640]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-09-29 61440]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"Samsung.PCSync"="c:\program files\Samsung\Samsung PC Studio 7\PcSync2.exe" [2009-06-04 1294336]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 10:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKLM\~\startupfolder\C:^Documents and Settings^Kung-Pao^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\documents and settings\Kung-Pao\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-10-03 03:08 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
2007-01-01 21:22 3739648 ----a-w- c:\program files\Google\Google Talk\googletalk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCommunicationsManager]
2006-12-22 11:27 497176 ----a-w- c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
2006-12-22 11:28 756248 ----a-w- c:\program files\Logitech\QuickCam10\QuickCam10.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 10:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\S60 PC Suite Tray]
2008-12-05 23:48 699392 ----a-w- c:\program files\Samsung\Samsung PC Studio 7\PCSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSTray]
2007-12-14 15:19 132624 ------w- c:\program files\Samsung\Samsung Media Studio 5\SMSTray.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys [27.12.2008 23:41 155136]
R0 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys [27.12.2008 23:41 5248]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [6.2.2009 14:23 107256]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [17.2.2009 11:43 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [17.2.2009 11:43 55024]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [14.5.2009 14:47 731840]
R3 KoneFltr;ROCCAT Kone;c:\windows\system32\drivers\Kone.sys [3.5.2009 19:26 12672]
S3 cpuz130;cpuz130;\??\c:\docume~1\Kung-Pao\LOCALS~1\Temp\cpuz130\cpuz_x32.sys --> c:\docume~1\Kung-Pao\LOCALS~1\Temp\cpuz130\cpuz_x32.sys [?]
S3 nmwcdsa;Samsung USB Phone Parent;c:\windows\system32\drivers\nmwcdsa.sys [14.8.2009 22:55 135680]
S3 nmwcdsac;Samsung USB Generic;c:\windows\system32\drivers\nmwcdsac.sys [14.8.2009 22:55 8320]
S3 nmwcdsacj;Samsung USB Port;c:\windows\system32\drivers\nmwcdsacj.sys [14.8.2009 22:55 12288]
S3 nmwcdsacm;Samsung USB Modem;c:\windows\system32\drivers\nmwcdsacm.sys [14.8.2009 22:55 12288]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [17.2.2009 11:43 7408]
S3 SSUSBDownload;SAMSUNG SYMBIAN USB Downloader Driver;c:\windows\system32\drivers\SSUSBDownload.sys [14.8.2009 23:00 17920]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: {2C46E150-8BEC-4C4D-AA41-6AA18B179EBA} = 10.100.1.200,0.0.0.0
FF - ProfilePath - c:\documents and settings\Kung-Pao\Application Data\Mozilla\Firefox\Profiles\areqlj0n.default\
FF - prefs.js: browser.startup.homepage - hxxps://mail.google.com/mail

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-07 22:46
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
P17Helper = Rundll32 SPIRun.dll,RunDLLEntry?

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x866B85B8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf761ff28
\Driver\ACPI -> ACPI.sys @ 0xf748ccb8
\Driver\atapi -> 0x866b85b8
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579022
ParseProcedure -> ntkrnlpa.exe @ 0x80577c84
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579022
ParseProcedure -> ntkrnlpa.exe @ 0x80577c84
NDIS: Realtek RTL8139 Family PCI Fast Ethernet NIC -> SendCompleteHandler -> NDIS.sys @ 0xf7326bd4
PacketIndicateHandler -> NDIS.sys @ 0xf7314a0d
SendHandler -> NDIS.sys @ 0xf7328b40
Warning: possible MBR rootkit infection !
user & kernel MBR OK
copy of MBR has been found in sector 11 !
copy of MBR has been found in sector 50 !

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-861567501-926492609-725345543-1004\Software\SecuROM\License information*]
"datasecu"=hex:86,85,d2,4c,b9,1b,e0,dc,6b,3b,82,14,6f,24,c4,0d,b3,eb,12,a3,81,
ab,b7,c2,f7,af,e7,94,2e,25,dc,20,25,fd,77,a5,e4,a6,ee,c8,49,2f,98,43,d2,3f,\
"rkeysecu"=hex:45,41,77,05,b9,b4,ee,6c,61,69,0a,aa,32,8e,10,7e

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OOPM02.00.00.01PRO"="72C89A0D0178419FC4234098BC58F95018A7AB096618DC2A3FCDA872EA0C24DE94C85E29817A4A2B54718BFEED47F0A54C449A991CC01B0ED2698447FBE6B8391A4E7AF4BED87802C6D3EB28D0BFF554DF855611BA52AEC20AE363A33AE94E2B16C1DA4FBE2640EDD92B63B1A89722B7DE65936FE20E74D25EF0CF8A41DF249090ACFE5A3A52E6BEC2FB06FEEA8DDFB04A009BF7E51A1A503EE569C061F5504C03BF797C20B784C6296CF9B7C1416C201717CA354EFEA34F0ABD604E1F3FB9C2DCCCF1DE129088DBA84A7DC58DB65B702F8F93F1562A6AE899147C0134B120DE82C9A4F063FB3458D2036059DEFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933C038D530D6EB34525D575E7D6A3B9808A6171C11EC38DE3D8101EE5CA9100C02C52387B5549388BD2265150C87481E735436508B3194946E8A44119A600878BD868F00B52E26D871CE56639D3A6F1BB0F6CAEBD1B4C1539FE99E23DE760FB693D258E27C30D517158CFE52F220F97438A40E09E2DEDD1A3FEDC4A9C4BA56CC0EA2B72150A1EA88709A3CE7241867D22F8524DDC04AB99170C6BFA859212605F0513BB16E6E413A069DC3AA37A84821F12906A1E1B4BD288C8D6C29A1BE586D309E4410062748F9849E1AA5AA7A41111080FB123180E18E9FBBFB3A944FDED8F5AC88BA3CFE855BD4099B69EEDA8D95CD60A9EE0CB23639EAAF726D9C333B5DA08413B3A74E11B690ADF589E8B978E7A10281FD44F5DB62622BA8D718EA0554408FC082569017250642AB1D722DE382B603C98720970A06AF554B935A1F67DC1B9F4431C567D706B8DD933F58EB45A76D652057590B0A66AD38DB3DAB1922D72B6522CE6B14A6FEDEFBD990DAD5255B598D733F9DE33B096DC3AE77C4C9876C1DFA346EAF7F6DF3E1FE7BB530E8A2E3C1C6881310DD0F35B3C7EC67D7C2800552D9A8256DB6A713E0AACC5480CCEC4FA23CF42CC5D50C78797B12B7053A86CEE062810FF5E7E548AFA67319E8C8CAEB2A7FA7E5494ECC26EAFA7195E40D2ABB13D7944A0CE84CC95300EA337AC994CF3D885D22986CFD5067C22DB181390E83E5E08A786830920D872701D6BA61B851732D2C46A5FAE45306363F42DB61E81F890A63C2B6D886CCB9EF5A3B2244B60E96AD7AB856E7D4490D9A7402E4CC08CC65C16ED11825868A0D93EB9C9E4AA56628AA83670444B995791CECAC04E5C88F91DBD2D420770886D6AD013A10F1AD7CDBA7D9C37EC5125C7CC69E0694BB1F2C5C8F8A7E5558134AA3BE39D7CB5B0CB996115E4086C76E867A105152E58192AD4779E285B5F2439EB0AB853D1BCA12CB76B2C958D24777428BCB225ABA8E3DE20896FCA4AF184A9571BD2F353BABA69FC9BDA8860D66E4007CB502ED"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(908)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(4032)
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Samsung\Samsung PC Studio 7\phonebrowser.dll
c:\program files\Samsung\Samsung PC Studio 7\PCSCM_Samsung.dll
c:\program files\Samsung\Samsung PC Studio 7\Lang\PhoneBrowser_eng.nlr
c:\program files\Samsung\Samsung PC Studio 7\Resource\PhoneBrowser_Samsung.ngr
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2010-02-07 22:49:16
ComboFix-quarantined-files.txt 2010-02-07 21:49
ComboFix2.txt 2010-02-05 23:03
ComboFix3.txt 2010-02-05 22:36
ComboFix4.txt 2010-02-05 21:13

Pre-Run: 4 554 526 720 bytes free
Post-Run: 4 546 768 896 bytes free

- - End Of File - - 3315A22EAE7C8FDE64AA2E3BC1D9775C

rootkity.JPG

prikladam sem zoznam vitrusov z rootkit revealeru.

(132.38 KiB) Staženo 394 x

[eriduan]

zdravim, len sa snazim o ozivenie temy, pretoze sa asi stratila medzi aktivnzmi temami a nik mi na poslednu odpoved nereagoval, prosim teda aj nadalej o pomoc, ak sa mi teda da pomoct

[Rudy]

RR je v pořádku. Nabootujte z instal. CD. Až na dolní liště uvidíte R-opravit, stiskněte "R" a vstupte do konzole pro zotavení (musíte znát heslo do účtu Administrator). Do příkazového řádku napište:

fixmbr

a odentrujte. Potvrďte na po provedení akce napište:

exit

Opět odentrujte. PC bude restartován.

[eriduan]

oukej, tak teda bootnem a fixnem mbr,
predpokladam ze mozem prist o vsetky data na disku C
takze pre istotu skor nez nieco fixnem, dam si zalohovat vsetko co pouzivam, je toho hodne, a polku uz mam skoro hotovu, ale ide to pomaly.

tak sa vopred ospravedlnujem, ale chvilku to bude trvat, dokym urobim kompletnu zalohu, tak prosim o strpenie,
myslim si ze radsej teraz pockam niekolko hodin, a potom ak sa to nahodou nezdari, tak aspon nebudem lutovat nad stratou
potom sem zas hodim odpoved ze to zbehlo

[Rudy]

Při odvirování se vyplatí zálohovat vždy. MBR má nějaký poroblém, akce ho obnoví ze zálohy.

[eriduan]

noo je tu problem.

ked som strcil origos instalacne cd do mechanik s mojim windows home edition tak mi iba spustilo instalaciu,
a ten puk windows sa tvaril jak virus

hned si vybral dalsiu particiu na disku ktora bola volna a zacal sa na nu bez otazky instalovat.
tak som ho zrusil vytiahnutim cd z mechaniky a siel som za kamosom po jeho profi win xp cedlo.

to sa uz regularne nabootovalo adal som r-repair

vybral som si particiu 1: C:\win

a napisal fixmbr

a vtedy mi vyhodilo na screen tieto slova

** CAUTION **
this computer appears to have a non-standard or invalid master bot record.

fixmbr may damage your partition tables if you proceed.

this could cause all the partitions on the current hard disk to become inaccessible.

if you are not having problems accessing your drive, do not continue.

are you sure you want to write a new mbr?

z toho som pochopil, ze cely disk mi tato cinnost odpise, takze najprv musim backupnut D:\
mam pravdu? asi ano.
takze idem este backupnut tu druhu particiu, co chvilku potrva, potom napisem vysledok samotnej fixacie mbr.
pisemto se preto aby bolo jasne ze na tom stale pracujem, ale povodne som si myslel ze postaci bacupnut particiu C, a ze nie cely disk.

a tiez preto, bo si nie som isty, ci som s tym win profi cedlom spravil spravnu vec, mohol som takto postupovat?
nespravi tam nejaku sarapatu fixnutie mbr z ineho ako z mojho vlastneho install cd?